# CVEs published 2024-07-24

85 CVEs were published on July 24, 2024: 12 critical, 29 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-0231](https://cve.now/CVE-2024-0231.md): Improper Control of Resource Identifiers ('Resource Injection') in GitLab (CVSS 2.7, GitLab)
- [CVE-2024-5067](https://cve.now/CVE-2024-5067.md): Exposure of Sensitive Information to an Unauthorized Actor in GitLab (CVSS 4.4, GitLab)
- [CVE-2024-7060](https://cve.now/CVE-2024-7060.md): Exposure of Sensitive Information to an Unauthorized Actor in GitLab (CVSS 2.6, GitLab)
- [CVE-2024-7091](https://cve.now/CVE-2024-7091.md): Exposure of Sensitive Information to an Unauthorized Actor in GitLab (CVSS 4.1, GitLab)
- [CVE-2024-7081](https://cve.now/CVE-2024-7081.md): itsourcecode Tailoring Management System expcatadd.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-41136](https://cve.now/CVE-2024-41136.md): Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface (CVSS 6.8, Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…)
- [CVE-2024-41135](https://cve.now/CVE-2024-41135.md): Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…)
- [CVE-2024-41134](https://cve.now/CVE-2024-41134.md): Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…)
- [CVE-2024-41133](https://cve.now/CVE-2024-41133.md): Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…)
- [CVE-2024-7080](https://cve.now/CVE-2024-7080.md): SourceCodester Insurance Management System direct request (CVSS 6.9, SourceCodester Insurance Management System)
- [CVE-2024-33519](https://cve.now/CVE-2024-33519.md): Authenticated Server-Side prototype pollution Leading to Information Disclosure (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…)
- [CVE-2024-21684](https://cve.now/CVE-2024-21684.md): There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. (CVSS 3.1, Atlassian Bitbucket Data Center)
- [CVE-2024-41672](https://cve.now/CVE-2024-41672.md): DuckDB: sniff\_csv provides filesystem access even when enable\_external\_access is disabled (CVSS 7.5, duckdb)
- [CVE-2024-41667](https://cve.now/CVE-2024-41667.md): OpenAM FreeMarker template injection (CVSS 8.8, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2024-41666](https://cve.now/CVE-2024-41666.md): The Argo CD web terminal session does not handle the revocation of user permissions properly. (CVSS 4.7, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2024-37533](https://cve.now/CVE-2024-37533.md): IBM InfoSphere Information Server information disclosure (CVSS 2.4, IBM InfoSphere Information Server)
- [CVE-2024-41662](https://cve.now/CVE-2024-41662.md): VNote vulnerable to Markdown XSS, which leads to RCE (CVSS 8.6, vnotex vnote)
- [CVE-2024-41110](https://cve.now/CVE-2024-41110.md): Moby authz zero length regression (CVSS 10.0, moby · github.com/moby/moby +1)
- [CVE-2024-7079](https://cve.now/CVE-2024-7079.md): Openshift-console: unauthenticated installation of helm charts (CVSS 6.5, openshift-console · Red Hat OpenShift Container Platform)
- [CVE-2024-7069](https://cve.now/CVE-2024-7069.md): SourceCodester Employee and Visitor Gate Pass Logging System sql injection (CVSS 5.3, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2024-22444](https://cve.now/CVE-2024-22444.md): A vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a refl (CVSS 6.1, Hewlett Packard Enterprise HPE Aruba Networking EdgeConnect…)
- [CVE-2024-22443](https://cve.now/CVE-2024-22443.md): A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to con (CVSS 7.2, Hewlett Packard Enterprise HPE Aruba Networking EdgeConnect…)
- [CVE-2024-7068](https://cve.now/CVE-2024-7068.md): SourceCodester Insurance Management System update\_sub\_category cross site scripting (CVSS 5.3, SourceCodester Insurance Management System)
- [CVE-2024-41914](https://cve.now/CVE-2024-41914.md): A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to con (CVSS 8.1, Hewlett Packard Enterprise HPE Aruba Networking EdgeConnect…)
- [CVE-2023-45249](https://cve.now/CVE-2023-45249.md): Remote command execution due to use of default passwords. (CVSS 9.8, KEV, Acronis Cyber Infrastructure)
- [CVE-2024-6096](https://cve.now/CVE-2024-6096.md): Unsafe Deserialization Vulnerability (CVSS 8.8, Progress Software Telerik Reporting)
- [CVE-2024-7067](https://cve.now/CVE-2024-7067.md): kirilkirkov Ecommerce-Laravel-Bootstrap Cart.php getCartProductsIds deserialization (CVSS 5.3, kirilkirkov Ecommerce-Laravel-Bootstrap)
- [CVE-2024-6327](https://cve.now/CVE-2024-6327.md): Progress Telerik Report Server Deserialization (CVSS 9.9, Progress Software Telerik Report Server)
- [CVE-2024-5818](https://cve.now/CVE-2024-5818.md): Royal Elementor Addons and Templates \<= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widget (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-3896](https://cve.now/CVE-2024-3896.md): Photo Gallery, Images, Slider in Rbs Image Gallery \<= 3.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Title (CVSS 6.4, robosoft Robo Gallery – Photo & Image Slider)
- [CVE-2024-6896](https://cve.now/CVE-2024-6896.md): AMP for WP – Accelerated Mobile Pages \<= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, mohammed\_kaludi AMP for WP – Accelerated Mobile Pages)
- [CVE-2024-7066](https://cve.now/CVE-2024-7066.md): F-logic DataCube3 HTTP POST Request config\_time\_sync.php os command injection (CVSS 6.9, F-logic DataCube3)
- [CVE-2024-7065](https://cve.now/CVE-2024-7065.md): Spina CMS cross-site request forgery (CVSS 6.9, Spina CMS)
- [CVE-2024-3297](https://cve.now/CVE-2024-3297.md): Session establishment lock-up during replay of CASE Sigma1 messages (CVSS 6.5, Connectivity Standards Alliance Matter)
- [CVE-2024-3454](https://cve.now/CVE-2024-3454.md): In-Fabric Matter Cluster Attribute Disclosure (CVSS 3.5, Connectivity Standards Alliance connectedhomeip)
- [CVE-2023-48362](https://cve.now/CVE-2023-48362.md): Apache Drill: XXE Vulnerability in XML Format Reader (CVSS 9.8, Apache Software Foundation Apache Drill · org.apache.drill.…)
- [CVE-2024-39676](https://cve.now/CVE-2024-39676.md): Apache Pinot: Unauthorized endpoint exposed sensitive information (CVSS 7.5, Apache Software Foundation Apache Pinot · org.apache.pinot:…)
- [CVE-2024-6874](https://cve.now/CVE-2024-6874.md): macidn punycode buffer overread (CVSS 3.1, curl)
- [CVE-2024-6930](https://cve.now/CVE-2024-6930.md): WP Booking Calendar \<= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode (CVSS 6.4, wpdevelop Booking Calendar)
- [CVE-2024-6197](https://cve.now/CVE-2024-6197.md): freeing stack buffer in utf8asn1str (CVSS 7.5, curl)
- [CVE-2023-32471](https://cve.now/CVE-2023-32471.md): Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds read vulnerability. (CVSS 6.0, Dell Edge Gateway)
- [CVE-2023-32466](https://cve.now/CVE-2023-32466.md): Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. (CVSS 5.7, Dell Edge Gateway)
- [CVE-2024-6629](https://cve.now/CVE-2024-6629.md): All-in-One Video Gallery \<= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcode (CVSS 6.4, plugins360 All-in-One Video Gallery)
- [CVE-2024-6571](https://cve.now/CVE-2024-6571.md): Optimize Images ALT Text (alt tag) & names for SEO using AI \<= 3.1.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, arnoldasarny Image SEO – AI-Driven Image SEO Optimizer)
- [CVE-2024-6553](https://cve.now/CVE-2024-6553.md): WP Meteor Website Speed Optimization Addon \<= 3.4.3 - Unauthenticated Full Path Disclosure (CVSS 5.3, aguidrevitch WP Meteor Website Speed Optimization Addon)
- [CVE-2024-6094](https://cve.now/CVE-2024-6094.md): WP ULike \< 4.7.1 - Admin+ Stored XSS (CVSS 4.8, WP ULike)
- [CVE-2024-6836](https://cve.now/CVE-2024-6836.md): Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells \<= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update (CVSS 4.3, amans2k FunnelKit – Funnel Builder for WooCommerce Checkout)
- [CVE-2024-3246](https://cve.now/CVE-2024-3246.md): LiteSpeed Cache \<= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, litespeedtech LiteSpeed Cache)
- [CVE-2024-5861](https://cve.now/CVE-2024-5861.md): WP Easy Pay (Free) \<= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection (CVSS 5.3, saadiqbal WP Easy Pay – Payment and Donation form Builder f…)
- [CVE-2024-6755](https://cve.now/CVE-2024-6755.md): Social Auto Poster \<= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (CVSS 6.5, WPWeb Social Auto Poster)
- [CVE-2024-6751](https://cve.now/CVE-2024-6751.md): Social Auto Poster \<= 5.3.14 - Cross-Site Request Forgery via Multiple Functions (CVSS 6.3, WPWeb Social Auto Poster)
- [CVE-2024-7027](https://cve.now/CVE-2024-7027.md): WooCommerce - PDF Vouchers \<= 4.9.3 - Authentication Bypass to Voucher Vendor (CVSS 7.3, WPWeb WooCommerce - PDF Vouchers)
- [CVE-2024-6754](https://cve.now/CVE-2024-6754.md): Social Auto Poster \<= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw\_auto\_poster\_update\_tweet\_template (CVSS 5.4, WPWeb Social Auto Poster)
- [CVE-2024-6753](https://cve.now/CVE-2024-6753.md): Social Auto Poster \<= 5.3.14 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, WPWeb Social Auto Poster)
- [CVE-2024-6752](https://cve.now/CVE-2024-6752.md): Social Auto Poster \<= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, WPWeb Social Auto Poster)
- [CVE-2024-6750](https://cve.now/CVE-2024-6750.md): Social Auto Poster \<= 5.3.14 - Missing Authorization via Multiple Functions (CVSS 7.3, WPWeb Social Auto Poster)
- [CVE-2024-6756](https://cve.now/CVE-2024-6756.md): Social Auto Poster \<= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, WPWeb Social Auto Poster)
- [CVE-2024-31970](https://cve.now/CVE-2024-31970.md): AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both ov (CVSS 7.2)
- [CVE-2024-31971](https://cve.now/CVE-2024-31971.md): Multiple stored cross-site scripting (XSS) vulnerabilities on AdTran NetVanta 3120 18.01.01.00.E devices allow remote attackers to inject ar (CVSS 6.1)
- [CVE-2024-31977](https://cve.now/CVE-2024-31977.md): Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters (CVSS 8.0)
- [CVE-2024-36533](https://cve.now/CVE-2024-36533.md): Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's (CVSS 9.8, volcano.sh/volcano · github.com/volcano-sh/volcano)
- [CVE-2024-36534](https://cve.now/CVE-2024-36534.md): Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service accoun (CVSS 8.4)
- [CVE-2024-36535](https://cve.now/CVE-2024-36535.md): Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's (CVSS 9.8)
- [CVE-2024-36536](https://cve.now/CVE-2024-36536.md): Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's (CVSS 9.8, github.com/fabedge/fabedge)
- [CVE-2024-36537](https://cve.now/CVE-2024-36537.md): Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service acco (CVSS 7.2)
- [CVE-2024-36538](https://cve.now/CVE-2024-36538.md): Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account (CVSS 8.8)
- [CVE-2024-36539](https://cve.now/CVE-2024-36539.md): Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's (CVSS 9.8)
- [CVE-2024-36540](https://cve.now/CVE-2024-36540.md): Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service (CVSS 9.8)
- [CVE-2024-36541](https://cve.now/CVE-2024-36541.md): Insecure permissions in logging-operator v4.6.0 allows attackers to access sensitive data and escalate privileges by obtaining the service a (CVSS 8.8)
- [CVE-2024-39345](https://cve.now/CVE-2024-39345.md): AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support (CVSS 7.5)
- [CVE-2024-40137](https://cve.now/CVE-2024-40137.md): Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter (CVSS 5.5, dolibarr/dolibarr)
- [CVE-2024-40422](https://cve.now/CVE-2024-40422.md): The snapshot\_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. (CVSS 9.1)
- [CVE-2024-40495](https://cve.now/CVE-2024-40495.md): A vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers to execute arbitrary code via th (CVSS 8.0)
- [CVE-2024-40575](https://cve.now/CVE-2024-40575.md): An issue in Huawei Technologies opengauss (openGauss 5.0.0 build) v.7.3.0 allows a local attacker to cause a denial of service via the modif (CVSS 6.5)
- [CVE-2024-40767](https://cve.now/CVE-2024-40767.md): In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 im (CVSS 6.5, nova)
- [CVE-2024-41459](https://cve.now/CVE-2024-41459.md): Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword parameter at ip/goform/Qu (CVSS 8.8)
- [CVE-2024-41460](https://cve.now/CVE-2024-41460.md): Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at ip/goform/RouteStat (CVSS 6.5)
- [CVE-2024-41461](https://cve.now/CVE-2024-41461.md): Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/DhcpListCl (CVSS 9.8)
- [CVE-2024-41462](https://cve.now/CVE-2024-41462.md): Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/DhcpListCli (CVSS 4.3)
- [CVE-2024-41463](https://cve.now/CVE-2024-41463.md): Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at ip/goform/addressNa (CVSS 4.3)
- [CVE-2024-41464](https://cve.now/CVE-2024-41464.md): Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/Rou (CVSS 9.8)
- [CVE-2024-41465](https://cve.now/CVE-2024-41465.md): Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/setcfm (CVSS 7.5)
- [CVE-2024-41466](https://cve.now/CVE-2024-41466.md): Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/NatStaticSe (CVSS 7.5)
- [CVE-2024-41550](https://cve.now/CVE-2024-41550.md): CampCodes Supplier Management System v1.0 is vulnerable to SQL injection via Supply\_Management\_System/admin/view\_invoice\_items.php?id= . (CVSS 7.2)
- [CVE-2024-41551](https://cve.now/CVE-2024-41551.md): CampCodes Supplier Management System v1.0 is vulnerable to SQL injection via Supply\_Management\_System/admin/view\_order\_items.php?id= . (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.